WO2017057165A1

WO2017057165A1 - Vehicle communication system

Info

Publication number: WO2017057165A1
Application number: PCT/JP2016/077959
Authority: WO
Inventors: 井上　雅之
Original assignee: 株式会社オートネットワーク技術研究所; 住友電装株式会社; 住友電気工業株式会社
Priority date: 2015-09-29
Filing date: 2016-09-23
Publication date: 2017-04-06
Also published as: JP6481579B2; DE112016004438T5; CN108028855B; US20180288000A1; CN108028855A; JP2017069719A; US10554623B2

Abstract

Provided is a vehicle communication system which can prevent a communication line from being occupied by a repetitive unauthorized message transmission. This vehicle communication system, in which a plurality of ECUs are connected through a communication line, is provided with a monitoring device having: a determination processing unit which determines whether a message is authorized; a discard processing unit which discards an unauthorized message before the completion of transmission; a storage unit which stores the ID of a discarded message; and a notification processing unit which outputs an ACK signal indicating a reception completion when a message having an ID stored in the storage unit is received. The discard processing unit does not discard any messages with an ID stored in the storage unit. Each ECU stores, in the storage unit, the IDs assigned to messages on which a discard process has been performed by the monitoring device, and prohibits processing on the basis of messages with IDs stored in the storage unit.

Description

In-vehicle communication system

The present invention relates to an in-vehicle communication system in which a plurality of communication devices connected to a common communication line transmit and receive messages.

Conventionally, a plurality of ECUs (Electronic Control Units) are mounted on a vehicle, and these are connected via a network such as CAN (Controller Area Network). The plurality of ECUs proceed with each process while exchanging information via a network. In recent years, there is a tendency that the size of a network in a vehicle becomes large. As an attack on such a vehicle network, for example, an unauthorized program can be injected into the ECU. An ECU into which an unauthorized program has been injected may transmit an unauthorized message to the vehicle network, which may cause other ECUs connected to the network to malfunction.

Patent Document 1 proposes a communication system that performs message authentication by MAC (Message Authentication Code) without changing the CAN protocol. In this communication system, each ECU counts the number of message transmissions for each CAN-ID. The transmission node generates a MAC from the data field of the main message, the CAN-ID and the count value, and transmits it as a MAC message. The receiving node generates a MAC from the data field, CAN-ID, and count value included in the received main message, and determines whether the MAC matches the MAC included in the MAC message.

In Non-Patent Document 1, each ECU monitors a message flowing on the network, and when a message with a CAN-ID to be transmitted from another ECU is transmitted from another ECU, it is determined as an illegal message. A communication system has been proposed in which an ECU that detects an illegal message transmits an error frame before transmission of the illegal message is completed, thereby preventing transmission.

JP 2013-98719 A

In the communication system described in Non-Patent Document 1, an ECU that detects an unauthorized message transmits an error frame to prevent the unauthorized message from being transmitted. However, the ECU (illegal ECU) in which the message transmission is in error repeats the message retransmission until the message is transmitted without error. When such re-transmission of the message continues, the communication line is occupied by this, and there is a possibility that regular message transmission by other ECUs may be hindered.

The present invention has been made in view of such circumstances, and an object of the present invention is to provide an in-vehicle communication system capable of preventing communication lines from being occupied due to repeated unauthorized message transmission. It is in.

The in-vehicle communication system according to the present invention is an in-vehicle communication system in which a plurality of communication devices mounted on a vehicle are connected via a common communication line, and whether or not the message transmitted on the communication line is a regular message. A determination unit that determines whether the message is determined not to be a legitimate message, a discard unit that performs processing for discarding the message before transmission completion of the message, and identification information of the message discarded by the discard unit When receiving a message to which the storage unit stores and identification information stored in the storage unit, a signal indicating that the reception of the message is completed is received regardless of a determination result of the determination unit. A reception completion notification unit that outputs to a line, and each communication device is prohibited from performing processing based on a message with identification information stored in the storage unit Has, the discard unit may not perform the processing to discard for identification information stored in the storage unit is attached message.

In addition, the in-vehicle communication system according to the present invention includes a storage erasure unit that erases the identification information stored in the storage unit when the signal is output from the reception completion notification unit.

Further, the in-vehicle communication system according to the present invention includes a monitoring device that is connected to the communication line, includes the determination unit, the discard unit, and the storage unit, and monitors a message transmitted on the communication line, Each communication device includes the storage unit, and at least one of the monitoring device and the plurality of communication devices includes the reception completion notification unit.

In the in-vehicle communication system according to the present invention, each communication device includes the determination unit, the discard unit, and the storage unit, and at least one of the plurality of communication devices is configured to receive the reception completion notification. It has the part.

Moreover, in the in-vehicle communication system according to the present invention, in a vehicle-mounted communication system in which a plurality of communication devices mounted on a vehicle are connected via a common communication line, a message transmitted on the communication line is a regular message. A determination unit that determines whether the message is not a legitimate message, a discard unit that performs processing for discarding the message before transmission completion of the message, and the number of times the message is discarded by the discard unit And a reception completion signal for outputting to the communication line a signal indicating that the reception of the message is completed regardless of the determination result of the determination unit when the counter count exceeds a predetermined number Each communication device is based on the received message when the number of times counted by the counter exceeds a predetermined number Has a prohibition unit that prohibits physical, it said discarding unit is characterized in that number of times the counter has counted does not perform processing to discard the message if it exceeds a predetermined number of times.

In the in-vehicle communication system according to the present invention, when a message is discarded by the discard unit, a storage unit that stores identification information of the discarded message and an identification different from the identification information stored in the storage unit And an initialization unit that initializes the counter when a message with information is transmitted to the communication line.

In addition, the in-vehicle communication system according to the present invention includes an initialization unit that initializes the counter when a signal from the reception completion notification unit is output.

The in-vehicle communication system according to the present invention includes a monitoring device that is connected to the communication line, includes the determination unit, the discard unit, and the counter, and that monitors a message transmitted on the communication line, The communication device includes the counter, and at least one of the monitoring device and the plurality of communication devices includes the reception completion notification unit.

In the in-vehicle communication system according to the present invention, each communication device includes the determination unit, the discard unit, and the counter, and at least one communication device of the plurality of communication devices includes the reception completion notification unit. It is characterized by having.

In the in-vehicle communication system according to the present invention, the monitoring device is a gateway device connected to a plurality of communication lines and relaying messages between the communication lines.

In the present invention, in the in-vehicle communication system configured to connect a plurality of communication devices via a common communication line, a determination unit that determines whether or not the message is a legitimate message, before sending a message that is not legitimate A discard unit for discarding, a storage unit for storing identification information attached to a discarded message, and a reception completion notification for outputting a signal indicating completion of reception when a message of the identification information stored in the storage unit is received Provide a part. The determination unit, the discard unit, the storage unit, and the reception completion notification unit may be provided in each communication device included in the in-vehicle communication system, or may be provided in a monitoring device connected to the communication line. .
Each communication device of the in-vehicle communication system does not perform processing based on the message with the identification information stored in the storage unit. The discarding unit does not perform processing for discarding the message to which the identification information stored in the storage unit is attached.
That is, in the in-vehicle communication system, the discarding unit performs discarding for the first transmission of an invalid message, and the identification information of the discarded message is stored at this time. In response to this discarding, for example, when an unauthorized communication device retransmits an unauthorized message, the discarding unit is not discarded because the identification information attached to the retransmitted message is stored in the storage unit. Although the reception completion signal is output by the reception completion notification unit, each communication device does not perform processing based on the unauthorized message. When the reception completion signal is output, the unauthorized communication device that has transmitted the unauthorized message determines that the unauthorized message has been received by another communication device, so that the unauthorized message is not retransmitted.

In the present invention, the storage unit that stores the identification information of the discarded message erases the stored identification information when the reception completion notification unit outputs a reception completion signal. Thereby, it can prevent that processing based on the regular message to which the same identification information as an illegal message is attached | subjected is not performed by each ECU.

In the present invention, in the in-vehicle communication system configured to connect a plurality of communication devices via a common communication line, a determination unit that determines whether or not the message is a normal message, before the transmission of the non-normal message is completed A discarding unit that discards the message, a counter that counts the number of times the message is discarded, and a reception completion notifying unit that outputs a signal indicating reception completion when the number of times the counter has counted exceeds a predetermined number. The determination unit, the discard unit, the counter, and the reception completion notification unit may be configured in each communication device included in the in-vehicle communication system, or may be configured in a monitoring device connected to the communication line.
Each communication device of the in-vehicle communication system does not perform processing based on the received message when the number of times counted by the counter exceeds a predetermined number. The discarding unit does not perform processing for discarding the message when the number of times counted by the counter exceeds a predetermined number.
In other words, in this in-vehicle communication system, the discarding unit discards an illegal message less than a predetermined number of times, and the counter counts the number of times the message is discarded. In response to this discard, for example, when an unauthorized communication device repeatedly retransmits an unauthorized message and the number of discards exceeds a predetermined number, a reception completion signal is output by the reception completion notification unit. The device does not perform processing based on this illegal message. When the reception completion signal is output, the unauthorized communication device that has transmitted the unauthorized message determines that the unauthorized message has been received by another communication device, so that the unauthorized message is not retransmitted.

In the present invention, the storage unit stores the identification information attached to the message discarded by the discard unit, and the message with the identification information different from the identification information stored in the storage unit is transmitted to the communication line. If a counter is detected, the counter is initialized. Thereby, it is possible to perform counting by the counter only when the same identification information is continuously transmitted.

In the present invention, the counter that counts the number of times the message is discarded initializes the count value when a reception completion signal is output by the reception completion notification unit. Thereby, it can prevent that the process based on a regular message is no longer performed in each ECU.

In the present invention, when the monitoring device is configured to perform processing such as discarding a message, it is preferable that the monitoring device is a gateway device that relays messages between communication lines. As a result, the gateway device can collectively perform a discarding process for a plurality of communication lines.

In the case of the present invention, after the invalid message is discarded, if the retransmission of the invalid message is repeated, the reception completion signal is output without discarding the invalid message, and the processing based on this message is performed by each communication device. By adopting a configuration in which the communication line is not performed, it is possible to prevent the communication line from being occupied due to repeated unauthorized message transmission.

1 is a schematic diagram illustrating a configuration of an in-vehicle communication system according to Embodiment 1. FIG. It is a flowchart which shows the procedure of the monitoring process which the monitoring apparatus which concerns on this Embodiment performs. It is a flowchart which shows the procedure of the reception process which each ECU which concerns on this Embodiment performs. It is a flowchart which shows the procedure of the reception process which each ECU which concerns on this Embodiment performs. It is a block diagram which shows the structure of the vehicle-mounted communication system which concerns on the modification 1. It is a block diagram which shows the structure of the vehicle-mounted communication system which concerns on the modification 2. 6 is a block diagram illustrating a configuration of an in-vehicle communication system according to Embodiment 2. FIG. 10 is a flowchart illustrating a procedure of monitoring processing performed by the monitoring device according to the second embodiment. 7 is a flowchart illustrating a procedure of reception processing performed by each ECU according to Embodiment 2. 7 is a flowchart illustrating a procedure of reception processing performed by each ECU according to Embodiment 2.

(Embodiment 1)
Hereinafter, the present invention will be specifically described with reference to the drawings showing embodiments thereof. FIG. 1 is a schematic diagram showing the configuration of the in-vehicle communication system according to the first embodiment. The in-vehicle communication system according to Embodiment 1 has a configuration in which a plurality of ECUs 30 mounted on a vehicle 1 are connected via a common communication line 2 and monitors transmission / reception of messages of the ECU 30 via the communication line 2. A monitoring device 10 is provided.

The monitoring apparatus 10 includes a processing unit 11, a communication unit 12, a storage unit 13, and the like. The processing unit 11 is configured using an arithmetic processing device such as a CPU (Central Processing Unit) or an MPU (Micro-Processing Unit), and by executing a program stored in a ROM (Read Only Memory) or the like (not shown), Various processes related to message monitoring are performed.

The communication unit 12 is connected to the communication line 2, and can send and receive messages to and from other ECUs 30 via the communication line 2. The communication unit 12 can be configured using a so-called CAN controller. The communication unit 12 receives the message by sampling the potential of the communication line 2 and gives the message to the processing unit 11, and also converts the message for transmission given from the processing unit 11 into an electric signal and outputs it to the communication line 2. Message can be sent. However, the monitoring device 10 according to the present embodiment does not need to transmit / receive messages to / from the ECU 30, and the communication unit 12 is used to monitor messages transmitted / received between the ECUs 30 via the communication line 2. .

The storage unit 13 is configured by using a memory element capable of data rewriting such as SRAM (Static Random Access Memory) or DRAM (Dynamic Random Access Memory). The processing unit 11 can store various data such as received messages in the storage unit 13. However, the monitoring apparatus 10 according to the present embodiment monitors a message transmitted / received via the communication line 2, determines that the message is an illegal message, and stores the ID attached to the message subjected to the discarding process. To remember.

In the processing unit 11 of the monitoring apparatus 10 according to the present embodiment, a determination processing unit 21, a discard processing unit 22, a notification processing unit 23, and an erasure are executed by executing a program for monitoring processing stored in a ROM or the like. The processing unit 24 and the like are realized as software function blocks. The determination processing unit 21 determines whether the message transmitted by the ECU 30 on the communication line 2 is a regular message. In the present embodiment, the determination method of the message by the determination processing unit 21 is not specified. The determination processing unit 21 may be configured to perform determination based on, for example, a MAC attached to a message, or may be configured to determine, for example, a message with an ID not registered in advance as an unauthorized message. Alternatively, the determination may be made by a method other than these methods.

The discard processing unit 22 performs a process of causing all the ECUs 30 connected to the communication line 2 to discard the message that the determination processing unit 21 determines is not a regular message, that is, an unauthorized message. Specifically, the discard processing unit 22 discards the invalid message by outputting an error frame from the communication unit 12 to the communication line 2 before the transmission of the invalid message output to the communication line 2 is completed. When the discard processing unit 22 performs the discard process, the processing unit 11 stores the ID attached to the unauthorized message in the storage unit 13 as a discard ID. In the present embodiment, one ID is stored in the storage unit 13 as the discard ID. When the discard processing unit 22 performs the discard process of the unauthorized message, it is possible to prevent the unauthorized message from being received by the ECU 30 and the processing based on the unauthorized message to be performed.

The notification processing unit 23 determines whether or not the ID of the message output to the communication line 2 matches the ID stored as the discard ID in the storage unit 13. When both IDs match, the notification processing unit 23 performs a process of notifying the completion of reception of this message regardless of whether or not this message is genuine. Specifically, the notification processing unit 23 outputs an ACK to the communication line 2 in the communication unit 12 in response to the transmission of this message, thereby notifying the ECU 30 that is the transmission source of this message of the reception completion. Since the notification processing unit 23 performs notification processing, it is possible to notify the transmission source of the unauthorized message that the reception has been completed, so that it is possible to prevent the unauthorized message from being retransmitted.

The erasure processing unit 24 performs processing for erasing the ID stored as the discard ID in the storage unit 13 from the storage unit 13 when the notification processing unit 23 outputs ACK. When the erasure processing unit 24 erases the discard ID, it is possible to prevent each ECU 30 from performing processing based on a regular message with the same ID as the discard ID.

Each ECU 30 (but regular ECU 30) included in the in-vehicle communication system according to the present embodiment includes a processing unit 31, a communication unit 32, a storage unit 33, and the like. The processing unit 31 is configured using an arithmetic processing device such as a CPU or MPU, and performs various processes related to the control of the vehicle 1. The communication unit 32 is for transmitting and receiving messages to and from other ECUs 30 via the communication line 2 and can be configured using a so-called CAN controller. The communication unit 32 receives the message by sampling the potential of the communication line 2 and gives the message to the processing unit 31, converts the message for transmission given from the processing unit 31 into an electrical signal, and outputs it to the communication line 2. Message can be sent.

Thereby, the ECU 30 can receive the message transmitted from the other ECU 30 by the communication unit 32 and perform processing based on the received message in the processing unit 31. Moreover, ECU30 can transmit the information produced | generated by the process of the process part 31 from the communication part 32 to other ECU30 as a message. For example, when the ECU 30 is an ECU that controls the headlight of the vehicle 1, the brightness information detected by the other ECU 30 by the sensor is received as a message, and the headlight according to the brightness information included in the received message. The processing unit 31 can perform a control process for switching on / off of. In addition, the process which ECU30 performs based on a received message is not limited to this, What kind of process may be sufficient.

The storage unit 33 is configured using a memory element capable of rewriting data, such as SRAM or DRAM. The processing unit 31 can store various data related to control in the storage unit 32. In addition, the ECU 30 according to the present embodiment discards this message in the middle of the reception process when the monitoring apparatus 10 outputs an error frame before the message output to the communication line 2 is completely transmitted. At the same time, the ID attached to this message is stored in the storage unit 33 as a discard ID. In the present embodiment, one ID is stored in the storage unit 33 as the discard ID.

In the processing unit 31 of the ECU 30 according to the present embodiment, a prohibition processing unit 41 is realized as a software functional block by executing a program for communication processing stored in a ROM or the like. The prohibition processing unit 41 prohibits processing using a message with the same ID as the discard ID stored in the storage unit 33. Accordingly, when the communication unit 32 receives a message with the same ID as the discard ID stored in the storage unit 33, the processing unit 31 does not perform processing using this message. Accordingly, it is possible to prevent each ECU 30 from performing a process based on a message having the same ID as the message for which the monitoring apparatus 10 determines that the information is invalid and the discard process is performed.

In addition, when the communication unit 32 receives a message with the same ID as the discard ID stored in the storage unit 33, the prohibition processing unit 41 stores an output of an ACK notifying completion of reception and the storage unit 33. The process of deleting the discarded ID is performed. (That is, the prohibition processing unit 41 also performs substantially the same processing as the notification processing unit 23 and the erasure processing unit 24 of the monitoring device 10).

FIG. 2 is a flowchart showing the procedure of the monitoring process performed by the monitoring apparatus 10 according to the present embodiment. The processing unit 11 of the monitoring apparatus 10 according to the present embodiment determines whether or not the message transmission of the ECU 30 to the communication line 2 has been performed (step S1). When message transmission is not performed (S1: NO), the processing unit 11 stands by until message transmission by the ECU 30 is performed. When the message transmission by the ECU 30 is performed (S1: YES), the processing unit 11 acquires the message ID when the message ID is output to the communication line 2 (step S2). Further, the processing unit 11 acquires the ID stored as the discard ID in the storage unit 13 (step S3). If the discard ID is not stored in the storage unit 13 at this time, the processing unit 11 may not acquire the ID.

The processing unit 11 determines whether or not the ID acquired in step S2 matches the ID acquired in step S3 (step S4). If the discard ID cannot be acquired in step S3, the processing unit 11 may determine that the IDs do not match in step S4. When both IDs do not match (S4: NO), the determination processing unit 21 of the processing unit 11 acquires this authentication information when the authentication information (MAC) included in the message is output to the communication line 2, The acquired authentication information is determined to be correct (step S5), and it is determined whether the message being transmitted to the communication line 2 is a regular message (step S6). In this flowchart, authentication information is attached to the message, and it is configured to determine whether the message is correct based on this authentication information. However, this is merely an example, and the message correctness determination is not limited to using authentication information. You may carry out by the method.

When the determination processing unit 21 determines that the message being transmitted to the communication line 2 is not a regular message (S6: NO), the discard processing unit 22 of the processing unit 11 performs communication before completing the transmission of this message. An error frame is output to the line 2 (step S7), and the ECU 30 discards this message. Next, the processing unit 11 stores the ID of this message as a discard ID in the storage unit 13 (step S8), and ends the process.

When the determination processing unit 21 determines that the message being transmitted to the communication line 2 is a regular message (S6: YES), the notification processing unit 23 of the processing unit 11 outputs an ACK to the communication line 2 (step S9). ), Notify the completion of reception of this message. Next, the processing unit 11 deletes the ID stored as the discard ID in the storage unit 13 (step S10), and ends the process.

3 and 4 are flowcharts showing the procedure of the reception process performed by each ECU 30 according to the present embodiment. The processing unit 31 of the ECU 30 according to the present embodiment determines whether or not a message is transmitted from another ECU 30 to the communication line 2 (step S21). If message transmission is not performed (S21: NO), the processing unit 31 waits until message transmission by another ECU 30 is performed. When the message is transmitted by another ECU 30 (S21: YES), the processing unit 31 acquires the message ID when the message ID is output to the communication line 2 (step S22). Further, the processing unit 31 acquires an ID stored as a discard ID in the storage unit 33 (step S23). If the discard ID is not stored in the storage unit 33 at this time, the processing unit 31 may not acquire the ID.

The processing unit 31 determines whether or not the ID acquired in step S22 matches the ID acquired in step S23 (step S24). If the discard ID cannot be acquired in step S23, the processing unit 31 may determine that the IDs do not match in step S24. If the two IDs do not match (S24: NO), the processing unit 31 determines whether or not an error frame has been received before the completion of transmission of this message (step S25). If no error frame has been received (S25: NO), the processing unit 31 receives a message output to the communication line 2 (step S26). The processing unit 31 outputs ACK to the communication line 2 (step S27) and notifies the completion of reception of this message. Thereafter, the processing unit 31 performs processing based on the received message (step S28) and ends the processing.

If the error frame is received before the transmission of the message on the communication line 2 is completed (S25: YES), the processing unit 31 interrupts the reception process of this message and discards this message (step S29). Further, the processing unit 31 stores the ID of this message as a discard ID in the storage unit 33 (step S30), and ends the process.

If the ID acquired in step S22 matches the ID acquired in step S23 (S24: YES), the prohibition processing unit 41 of the processing unit 31 prohibits processing based on the received message (step S31). The processing unit 31 outputs ACK to the communication line 2 (step S32) and notifies the completion of reception of this message. Next, the processing unit 31 deletes the ID stored as the discard ID in the storage unit 33 (step S33) and ends the process.

In the in-vehicle communication system according to the first embodiment having the above configuration, the determination is made as to whether or not it is a legitimate message in the in-vehicle communication system in which a plurality of ECUs 30 are connected via the common communication line 2. The processing unit 21, a discard processing unit 22 that performs processing for discarding an unauthorized message before transmission is completed, a storage unit 13 that stores the ID of the discarded message, and a message with an ID stored in the storage unit 13 In this case, the monitoring apparatus 10 including the notification processing unit 23 that performs processing to output an ACK signal indicating completion of reception is provided. Note that the discard processing unit 22 does not perform the discard process on the message with the ID stored as the discard ID in the storage unit 13. Further, each ECU 30 stores the ID attached to the message that has been discarded by the monitoring device 10 as a discard ID in the storage unit 33, and the prohibition processing unit 41 has the message that is assigned the ID stored in the storage unit 33. By prohibiting processing based on, the processing based on illegal messages is not performed.

That is, in the in-vehicle communication system according to the present embodiment, the discard processing unit 22 of the monitoring device 10 discards the first transmission of an invalid message, and the ID of the discarded message is the monitoring device. 10 and ECU 30 respectively. In response to discarding this message, when an unauthorized ECU or the like retransmits an unauthorized message, the monitoring device 10 and the ECU 30 store the IDs attached to the retransmitted message. The discard processing unit 22 does not perform the discarding and the notification processing unit 23 outputs the reception completion ACK signal. However, each ECU 30 is prohibited from performing the processing based on the unauthorized message. By outputting an ACK signal indicating completion of reception for an illegal message, an unauthorized ECU that has transmitted the unauthorized message determines that this message has been received by another ECU 30, so that the unauthorized message is retransmitted. Disappear.

Further, the erasure processing unit 24 of the monitoring device 10 erases the ID stored as the discard ID in the storage unit 13 when the reception processing ACK signal is output by the notification processing unit 23. Similarly, each ECU 30 erases the ID stored in the storage unit 33 when receiving a message with the ID stored as the discard ID in the storage unit 33. Thereby, it can prevent that the process based on the regular message to which the same ID as an illegal message is attached | subjected is not performed by each ECU30.

In the present embodiment, the monitoring apparatus 10 is configured such that the processing unit 11 performs each process of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, and the erasure processing unit 24. However, the present invention is not limited to this. For example, it is good also as a structure which the communication part 12 performs. In this case, the storage unit 13 may be configured to be directly accessible by the communication unit 12 or may be provided in the communication unit 12. Similarly, the ECU 30 has a configuration in which the processing of the prohibition processing unit 41 is performed by the processing unit 31, but is not limited thereto, and may be configured by, for example, the communication unit 32.

In the present embodiment, each ECU 30 included in the in-vehicle communication system of the vehicle 1 performs communication according to the CAN protocol. However, the present invention is not limited to this. Each ECU 30 may be configured to perform communication according to a protocol other than CAN, for example, a protocol such as TCP / IP or FlexRay. In addition, the on-vehicle communication system mounted on the vehicle 1 has been described as an example. However, the present invention is not limited to this, and the on-vehicle communication system mounted on a mobile body such as an aircraft or a ship, or installed in a factory or an office. The present technology may be applied to a vehicle-mounted communication system other than the vehicle-mounted communication system such as a vehicle-mounted communication system. In the above-described embodiment, the monitoring device 10 that performs the processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, and the erasing processing unit 24 is provided separately from the ECU 30, but the present invention is not limited thereto. It is not a thing. For example, as shown in Modification 1 below, each ECU 30 may perform the processes of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, and the erasing processing unit 24.

(Modification 1)
FIG. 5 is a block diagram illustrating a configuration of the in-vehicle communication system according to the first modification. The in-vehicle communication system according to Modification 1 does not include the monitoring device 10 that monitors messages transmitted and received on the communication line 2, and each ECU 130 connected to the communication line 2 monitors the message. Each ECU 130 executes a predetermined program stored in a ROM or the like, so that a determination processing unit 21, a discard processing unit 22, a notification processing unit 23, an erasing processing unit 24, a prohibition processing unit 41, etc. Realized as a functional block. The processing performed by these functional blocks is substantially the same as that of the monitoring device 10 and the ECU 30 according to the first embodiment described above.

That is, each ECU 130 according to Modification 1 determines whether or not the message transmitted from the other ECU 130 to the communication line 2 is a regular message. At this time, the determination processing unit 21 may be configured to determine this message as an illegal message when, for example, a message with an ID to be transmitted by the other ECU 130 is transmitted, and for example, authentication information attached to the message It is good also as a structure which determines based on these, and it is good also as a structure which determines with a method other than these. When the determination processing unit 21 determines that the message is an unauthorized message, the discard processing unit 22 of each ECU 130 outputs an error frame to the communication line 2 before the transmission of this message is completed, thereby causing another ECU 130 to discard the unauthorized message. I do. The processing unit 131 of each ECU 130 was attached to this message when the message was discarded by its own discard processing unit 22 and when the message was discarded by the error frame output of another ECU 130. The ID is stored in the storage unit 33 as a discard ID.

Further, the notification processing unit 23 of each ECU 130 outputs an ACK signal to the communication line 2 when the ID of the message transmitted to the communication line 2 matches the discard ID stored in the storage unit 33. Notify the sender of the reception completion. However, the prohibition processing unit 41 of each ECU 130 prohibits the processing based on the message with the ID that matches the discard ID stored in the storage unit 33, thereby causing the processing unit 131 of each ECU 130 to process the illegal message. No processing based on it is performed. When the notification processing unit 23 outputs an ACK signal, the deletion processing unit 24 of each ECU 130 deletes the ID stored in the storage unit 33 as the discard ID.

As described above, in the in-vehicle communication system according to the first modified example, each ECU 130 includes the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the prohibition processing unit 41. It is possible to prevent the ECU from repeating retransmission of the unauthorized message.

(Modification 2)
FIG. 6 is a block diagram illustrating a configuration of the in-vehicle communication system according to the second modification. The in-vehicle communication system according to the modified example 2 has a configuration in which the communication line 2 and the communication line 3 to which a plurality of ECUs 30 are connected are connected to the gateway 210 and the gateway 210 relays a message between the

communication lines

2 and 3. . In the case of this configuration, the gateway 210 can be provided with a monitoring function similar to that of the monitoring device 10 according to the first embodiment.

The gateway 210 according to Modification 2 includes a processing unit 211,

communication units

12a and 12b, and a storage unit 13. The two

communication units

12 a and 12 b are connected to the

communication lines

2 and 3, respectively, and send and receive messages to and from the ECU 30 via the connected

communication lines

2 and 3. The processing unit 211 performs processing for relaying a message between the

communication lines

2 and 3 by transmitting a message received by one of the

communication units

12a and 12b from the other. Further, the processing unit 211 executes a predetermined program stored in a ROM or the like, so that the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the like are realized as software functional blocks. Is done. The processing performed by these functional blocks is substantially the same as that of the monitoring device 10 according to the first embodiment described above, but the message monitoring processing is individually performed for the two

communication lines

2 and 3.

As described above, in the in-vehicle communication system according to the second modification, the message monitoring function is provided in the gateway 210 to which the plurality of

communication lines

2 and 3 are connected. As a result, message monitoring can be performed centrally at the gateway 210, and the in-vehicle communication system can be reduced in size and cost compared to the configuration in which the monitoring devices 10 are provided on the

communication lines

2 and 3, respectively. it can.

(Embodiment 2)
FIG. 7 is a block diagram illustrating a configuration of the in-vehicle communication system according to the second embodiment. Similarly to the in-vehicle communication system according to the first embodiment, the in-vehicle communication system according to the second embodiment has a configuration in which a plurality of ECUs 330 mounted on the vehicle 1 are connected via a common communication line 2. A monitoring device 310 that monitors transmission / reception of messages of the ECU 330 via the line 2 is provided.

The monitoring device 310 includes a processing unit 311, a communication unit 12, a storage unit 13, a counter 314, and the like. The processing unit 311 is configured using an arithmetic processing device such as a CPU or MPU, and performs various processes related to message monitoring by executing a program stored in a ROM (not shown) or the like. The counter 314 is a circuit that stores a numerical value, and increments (counts up) the stored numerical value in response to the addition instruction given from the processing unit 311 and sets the stored numerical value to 0 in response to the initialization instruction. initialize. In the second embodiment, the counter 314 counts the number of times that a message is determined to be invalid and discarded.

In the processing unit 311 of the monitoring apparatus 310 according to the second embodiment, a determination processing unit 21, a discard processing unit 22, a notification processing unit 23, and an erasure are performed by executing a program for monitoring processing stored in a ROM or the like. The processing unit 24, the initialization processing unit 325, and the like are realized as software functional blocks. The determination processing unit 21 determines whether or not the message transmitted by the ECU 330 on the communication line 2 is a regular message. When the determination processing unit 21 determines that the message is not a legitimate message, the discard processing unit 22 outputs an error frame to the communication line 2 before completing the transmission of the message, thereby causing the ECU 330 to discard the invalid message. Do. When the discard processing unit 22 performs the discard process, the processing unit 311 stores the ID attached to the unauthorized message as a discard ID in the storage unit 13 and counts up the counter 314.

Thereafter, when a message is transmitted to the communication line 2, the processing unit 311 determines whether or not the ID of this message matches the discard ID stored in the storage unit 13. If the two IDs do not match, it is determined that the invalid message has not been retransmitted, the initialization processing unit 325 of the processing unit 311 initializes the counter 314, and the deletion processing unit 24 stores it in the storage unit 13. Delete the discard ID. When both IDs match, the processing unit 311 determines whether or not the numerical value stored in the counter 314 exceeds a predetermined number. When the numerical value of the counter 314 does not exceed the predetermined number, similarly to the above, the determination processing unit 21 determines whether the message is a regular message, and the discard processing unit 22 discards the invalid message.

When the value of the counter 314 exceeds a predetermined number, the notification processing unit 23 outputs an ACK to the communication line 2 at the communication unit 12 in response to the transmission of this message regardless of whether the message is genuine or not. As a result, the message transmission source is notified of the reception completion. When the notification processing unit 23 outputs an ACK, the erasure processing unit 24 performs a process of erasing the ID stored as the discard ID in the storage unit 13 from the storage unit 13. Similarly, in this case, the initialization processing unit 325 performs processing for initializing the counter 314.

Each ECU 330 included in the in-vehicle communication system according to Embodiment 2 includes a processing unit 331, a communication unit 32, a storage unit 33, a counter 334, and the like. The processing unit 331 is configured using an arithmetic processing device such as a CPU or MPU, and performs various processes related to the control of the vehicle 1. In the processing unit 331 of the ECU 330 according to the second embodiment, a prohibition processing unit 41 is realized as a software functional block by executing a program for communication processing stored in a ROM or the like. The counter 334 is a circuit that stores a numerical value, counts up the stored numerical value in response to the addition command given from the processing unit 331, and initializes the stored numerical value to 0 in response to the initialization command. .

When the message transmitted to the communication line 2 is discarded due to the error frame of the monitoring device 310, the processing unit 331 of each ECU 330 according to the second embodiment stores the ID attached to this message in the storage unit 33. . The prohibition processing unit 41 prohibits processing using a message with the same ID as the discard ID stored in the storage unit 33. Thereafter, when a message is transmitted to the communication line 2, the processing unit 331 determines whether the ID of this message matches the discard ID stored in the storage unit 33. If the two IDs do not match, it is determined that the invalid message has not been retransmitted, and the processing unit 331 initializes the counter 334 and erases the discard ID stored in the storage unit 33. When both IDs match, the processing unit 331 determines whether or not the numerical value stored in the counter 334 exceeds a predetermined number. Note that the predetermined number that the ECU 330 compares with the counter 334 is the same value as the predetermined number that the monitoring device 310 compares with the counter 314. If the value of the counter 334 does not exceed the predetermined number, the processing unit 331 performs a normal message reception process (however, this message may be discarded by the monitoring device 310).

When the numerical value of the counter 334 exceeds a predetermined number, the processing unit 331 notifies the transmission source of the message of reception completion by outputting an ACK to the communication line 2 in the communication unit 32 in response to the transmission of this message. At this time, the processing unit 331 performs processing for deleting the ID stored as the discard ID in the storage unit 33 and initializing the counter 334.

FIG. 8 is a flowchart showing the procedure of the monitoring process performed by the monitoring apparatus 310 according to the second embodiment. The processing unit 311 of the monitoring device 310 according to the second embodiment determines whether or not the message transmission of the ECU 330 to the communication line 2 has been performed (step S51). When message transmission is not performed (S51: NO), the process part 311 waits until message transmission by ECU330 is performed. When the message transmission is performed by the ECU 330 (S51: YES), the processing unit 311 acquires the message ID when the message ID is output to the communication line 2 (step S52). Further, the processing unit 311 acquires the ID stored as the discard ID in the storage unit 13 (step S53). If the discard ID is not stored in the storage unit 13 at this time, the processing unit 11 may not acquire the ID.

The processing unit 311 determines whether or not the ID acquired in step S52 matches the ID acquired in step S53 (step S54). If the discard ID cannot be acquired in step S53, the processing unit 311 may determine that the IDs do not match in step S54. If the two IDs do not match (S54: NO), the initialization processing unit 325 of the processing unit 311 initializes the counter 314 (step S55). In addition, the erasure processing unit 24 of the processing unit 311 erases the ID stored as the discard ID in the storage unit 33 (step S56), and the process proceeds to step S58.

If both IDs match (S54: YES), the processing unit 311 determines whether or not the numerical value stored in the counter 314 exceeds a predetermined number (step S57). When the numerical value of the counter 314 does not exceed the predetermined number (S57: NO), or after erasing the ID from the storage unit 33 in step S56, the determination processing unit 21 of the processing unit 311 sends a message to the communication line 2. This authentication information is acquired at the stage when the authentication information included in the message is output, the acquired authentication information is determined to be correct (step S58), and whether or not the message being transmitted to the communication line 2 is a legitimate message is determined. Determination is made (step S59).

When the determination processing unit 21 determines that the message being transmitted to the communication line 2 is not a regular message (S59: NO), the discard processing unit 22 of the processing unit 311 performs communication before the transmission of this message is completed. An error frame is output to the line 2 (step S60), and this message is discarded by the ECU 330. The processing unit 311 stores the ID of this message in the storage unit 13 as a discard ID (step S61). In addition, the processing unit 311 adds 1 to the value of the counter 314 (step S62), and ends the processing.

When the value of the counter 314 exceeds a predetermined number (S57: YES), or when the determination processing unit 21 determines that the message being transmitted to the communication line 2 is a regular message (S59: YES), the processing unit 311. The notification processing unit 23 outputs ACK to the communication line 2 (step S63) and notifies the completion of reception of this message. The processing unit 311 deletes the ID stored as the discard ID in the storage unit 13 (step S64). Further, the processing unit 311 initializes the counter 314 (step S65) and ends the process.

FIGS. 9 and 10 are flowcharts showing the procedure of the reception process performed by each ECU 330 according to the second embodiment. The processing unit 331 of the ECU 330 according to the second embodiment determines whether or not a message is transmitted from another ECU 330 to the communication line 2 (step S71). When message transmission is not performed (S71: NO), processing part 331 stands by until message transmission by other ECU330 is performed. When the message is transmitted by the other ECU 330 (S71: YES), the processing unit 331 acquires the message ID when the message ID is output to the communication line 2 (step S72). In addition, the processing unit 331 acquires an ID stored as a discard ID in the storage unit 33 (step S73). If the discard ID is not stored in the storage unit 33 at this time, the processing unit 331 may not acquire the ID.

The processing unit 331 determines whether the ID acquired in Step S72 matches the ID acquired in Step S73 (Step S74). If the discard ID cannot be acquired in step S73, the processing unit 331 may determine that the IDs do not match in step S74. If the two IDs do not match (S74: NO), the processing unit 331 determines whether or not an error frame has been received before the completion of transmission of this message (step S75). When no error frame has been received (S75: NO), the processing unit 331 receives a message output to the communication line 2 (step S76). The processing unit 331 outputs ACK to the communication line 2 (step S77) and notifies the completion of reception of this message. The processing unit 331 performs processing based on the received message (step S78). The processing unit 331 initializes the counter 334 (step S79), deletes the ID stored as the discard ID in the storage unit 33 (step S80), and ends the process.

If an error frame is generated before the transmission of the message on the communication line 2 is completed (S75: YES), the processing unit 331 interrupts this message reception process and discards this message (step S81). The processing unit 331 stores the ID of this message as a discard ID in the storage unit 33 (step S82), adds 1 to the value of the counter 334 (step S83), and ends the process.

When the ID acquired in step S72 matches the ID acquired in step S73 (S74: YES), the processing unit 331 determines whether or not the numerical value stored in the counter 334 exceeds a predetermined number. (Step S84). When the numerical value of the counter 334 does not exceed the predetermined number (S84: NO), the processing unit 331 advances the process to step S75. When the numerical value of the counter 334 exceeds the predetermined number (S84: YES), the prohibition processing unit 41 of the processing unit 331 prohibits processing based on the received message (step S85). The processing unit 331 outputs ACK to the communication line 2 (step S86) and notifies the completion of reception of this message. Next, the processing unit 331 deletes the ID stored as the discard ID in the storage unit 33 (step S87), initializes the counter 334 (step S88), and ends the process.

In the in-vehicle communication system according to the second embodiment having the above-described configuration, the determination processing unit 21 that determines whether or not the message is a regular message in a system in which a plurality of ECUs 330 are connected via the common communication line 2; A discard processing unit 22 that discards an unauthorized message before completion of transmission, a counter 314 that counts the number of times the message is discarded, and a notification processing unit 23 that outputs an ACK signal when the numerical value stored in the counter exceeds a predetermined number It is the structure which provided the monitoring apparatus 310 which has. The discard processing unit 22 does not perform processing for discarding a message when the value of the counter 314 exceeds a predetermined number. Each ECU 330 has a counter 334 that counts the number of times the message is discarded by the monitoring device 310. If the value of the counter 334 exceeds a predetermined number, processing based on the received message is prohibited and not performed.

In other words, in the in-vehicle communication system according to the second embodiment, the discard processing unit 22 discards an unauthorized message less than a predetermined number of times, and the counter 314 and the counter 334 determine the number of times the message is discarded. Be counted. In response to the discard by the discard processing unit 22, for example, when an unauthorized ECU repeatedly transmits an invalid message and the number of discards exceeds a predetermined number, the notification processing unit 23 of the monitoring device 310 outputs an ACK signal. Although performed, each ECU 330 is prohibited from performing processing based on the unauthorized message. By outputting the ACK signal indicating the completion of reception, the unauthorized ECU that has transmitted the unauthorized message determines that the unauthorized message has been received by the ECU 330, so that the unauthorized message is not retransmitted.

The monitoring device 310 also includes a storage unit 13 that stores an ID attached to a message discarded by the discard processing unit 22, and a message with an ID different from the ID stored in the storage unit 13 is transmitted to the communication line 2. The counter 314 is initialized. Similarly, each ECU 330 includes a storage unit 33 that stores an ID attached to a message that has been discarded by the monitoring device 310, and a message with an ID different from the ID stored in the storage unit 33 is transmitted. If so, the counter 334 is initialized. As a result, counting by the

counters

314 and 334 can be performed only when the same ID is continuously transmitted.

The

counters

314 and 334 are initialized when the ACK signal is output by the notification processing unit 23 of the monitoring device 310. Thereby, it is possible to prevent the processing based on the regular message from being continuously prohibited by each ECU 330.

In the second embodiment, the monitoring apparatus 310 that performs each process of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the deletion processing unit 24, and the initialization processing unit 325 is provided separately from the ECU 330. However, it is not limited to this. For example, each ECU 330 performs each process of the determination processing unit 21, the discard processing unit 22, the notification processing unit 23, the erasing processing unit 24, and the initialization processing unit 325, similarly to the configuration shown in the first modification of the first embodiment. It is good also as a structure.

In addition, since the other configuration of the in-vehicle communication system according to the second embodiment is the same as that of the in-vehicle communication system according to the first embodiment, the same parts are denoted by the same reference numerals and detailed description thereof is omitted.

DESCRIPTION OF SYMBOLS 1

Vehicle

2, 3 Communication line 10 Monitoring apparatus 11

Processing part

12, 12a, 12b Communication part 13 Storage part 21 Determination processing part (determination part)
22 Discard processing part (discard part)
23 Notification Processing Unit (Reception Complete Notification Unit)
24 Deletion processing part (memory erasure part)
30 ECU (communication device)
31 Processing Unit 32 Communication Unit 33 Storage Unit 41 Prohibited Processing Unit (Prohibited Unit)
130 ECU (communication device)
131 Processing Unit 210 Gateway 211 Processing Unit 310 Monitoring Device 311 Processing Unit 314 Counter 325 Initialization Processing Unit (Initialization Unit)
330 ECU (communication device)
331 processing unit 334 counter

Claims

In an in-vehicle communication system in which a plurality of communication devices mounted on a vehicle are connected via a common communication line,
A determination unit that determines whether or not a message transmitted on the communication line is a regular message;
A discarding unit that performs processing for discarding a message that the determination unit determines that the message is not a regular message before transmission of the message is completed;
A storage unit for storing identification information of a message discarded by the discard unit;
When a message with identification information stored in the storage unit is received, a signal indicating that reception of the message is completed is output to the communication line regardless of the determination result of the determination unit. With a notification unit,
Each communication device has a prohibition unit that prohibits processing based on a message with identification information stored in the storage unit,
The in-vehicle communication system, wherein the discard unit does not perform a process of discarding a message attached with identification information stored in the storage unit.
The in-vehicle communication system according to claim 1, further comprising a storage erasure unit that erases the identification information stored in the storage unit when the signal is output from the reception completion notification unit.
A monitoring device connected to the communication line, having the determination unit, the discarding unit, and the storage unit, and monitoring a message transmitted on the communication line;
Each communication device has the storage unit,
The in-vehicle communication system according to claim 1 or 2, wherein at least one of the monitoring device and the plurality of communication devices includes the reception completion notification unit.
Each communication device includes the determination unit, the discard unit, and the storage unit,
The in-vehicle communication system according to claim 1, wherein at least one communication device of the plurality of communication devices includes the reception completion notification unit.
In an in-vehicle communication system in which a plurality of communication devices mounted on a vehicle are connected via a common communication line,
A determination unit that determines whether or not a message transmitted on the communication line is a regular message;
A discarding unit that performs processing for discarding a message that the determination unit determines that the message is not a regular message before transmission of the message is completed;
A counter that counts the number of times the message is discarded by the discard unit;
A reception completion notification unit that outputs a signal indicating completion of reception of the message to the communication line regardless of a determination result of the determination unit when the number of times counted by the counter exceeds a predetermined number of times, and
Each communication device has a prohibition unit that prohibits processing based on a received message when the number of times counted by the counter exceeds a predetermined number of times,
The discarding unit does not perform processing for discarding a message when the number of times counted by the counter exceeds a predetermined number.
A storage unit that stores identification information of the discarded message when the message is discarded by the discarding unit;
6. An initialization unit that initializes the counter when a message with identification information different from the identification information stored in the storage unit is transmitted to the communication line. The in-vehicle communication system described in 1.
The in-vehicle communication system according to claim 5 or 6, further comprising: an initialization unit that initializes the counter when a signal from the reception completion notification unit is output.
A monitoring device connected to the communication line, having the determination unit, the discarding unit, and the counter, and monitoring a message transmitted on the communication line;
Each communication device has the counter,
The in-vehicle communication system according to any one of claims 5 to 7, wherein at least one of the monitoring device and the plurality of communication devices includes the reception completion notification unit.
Each communication device includes the determination unit, the discard unit, and the counter,
The in-vehicle communication system according to any one of claims 5 to 7, wherein at least one communication device of the plurality of communication devices includes the reception completion notification unit.
The in-vehicle communication system according to claim 3 or 8, wherein the monitoring device is a gateway device that is connected to a plurality of communication lines and relays a message between the communication lines.